On July 6, the decentralized finance protocol Summer.fi fell victim to a targeted hacker attack. The project team confirmed the incident, announcing a temporary suspension of all vaults within the Lazy Summer Protocol system to investigate the causes.
Exploit Details: Price Manipulation and Flash Loans
My analysis shows that the attacker used a complex multi-stage scheme. According to monitoring service data, the attacker exploited a vulnerability in the asset share accounting mechanism, allowing them to artificially distort prices. They then converted the stolen funds into DAI stablecoins and withdrew them to their wallet. The total damage amounted to approximately $6 million.
The key tool of the attack was a flash loan worth $65.4 million. The temporary increase in liquidity within the protocol allowed the hacker to initiate a withdrawal of $70.9 million. The difference between the deposit and withdrawal became their net profit.
Technical Background: Vulnerability in FleetCommander
Security experts note that the root of the problem lies in the distortion of the totalAssets() metric in the FleetCommander smart contracts, which manage the distribution of funds between vaults. An additional factor was the Ark contract, responsible for integration with external lending platforms. The manipulation affected the system that automatically redistributes user deposits, enabling the hacker to carry out the attack.
This incident once again highlights the vulnerability of DeFi protocols to attacks through manipulation of oracles and internal metrics. Against the backdrop of total losses from crypto hacks dropping to $75.9 million in June, and the number of exploits reaching a record 83 cases in the second quarter, this hack serves as a warning signal for the entire industry.
My expert opinion: The attack on Summer.fi is a classic example of how the complexity of smart contracts in DeFi becomes their Achilles' heel. Protocols need not only to implement multi-layered audit systems but also to develop dynamic protection mechanisms against manipulation of totalAssets metrics, especially when using flash loans. Until the market revises its approach to security, such incidents, unfortunately, will remain the norm.